Cadet 3rd Class
Cadet 3rd Class
424 views

Flex Connector error "File Processing ended : Failure", not able to parse logs.

I am a beginner to ArcSight. I have written a flexconnector for variable format logs. I am getting logs FTPed in a directory. Now when I deployed my connector it seems everything has gone fine at my point. But when I created a channel for my connector in ArcSight Manager console I am getting only following alerts:

Connector Raw Event Statistics

File processing started

File processing ended: Failure

Connector Raw Event Statistics

File processing started

File processing ended: Failure

Connector Raw Event Statistics

File processing started

File processing ended: Failure

Connector Raw Event Statistics

File processing started

File processing ended: Failure....

It seems my flex connector is trying to parse the log file but due to some error failing.

Can anyone please help me out in this issue how to troubleshoot the issue. How can I get to know what is the error?

Is there any way to troubleshoot or debug my parser. Is this something related to my parser or log file or some configuration.

Labels (2)
0 Likes
1 Reply
Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class

The problem is probably in your agent.properties parameters.  There is a parameter in that file that will tell ArcSight to start parsing at the beginning or end of the file.  In your case this should probably be set to false, so that once the file is received the Connector will process the entire file.

agents[0].foldertable[0].startatend=false

The agent.log file is the place where most of the information is located telling what the connector is doing.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.